Tutor LMS Pro Insecure Direct Object Reference Vulnerability Allowing Assignment Manipulation

A vulnerability exists in the Tutor LMS Pro WordPress plugin, specifically in versions through 3.8.3. This issue is an Insecure Direct Object Reference (IDOR) that arises from inadequate validation of user-controlled keys in the tutor_assignment_submit() function. As a result, authenticated attackers with Subscriber-level access or higher can access and modify assignment submissions of other students.

Impact

Exploitation of this vulnerability allows for unauthorized viewing and editing of assignment submissions belonging to other students.

Remediation

Users can update to Tutor LMS Pro version 3.9.0 or later, where this vulnerability has been patched.